T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:24- Finding
Network-Exposed SearXNG Service with an Insecure Default Secret
- Content
View full analysis
docker-compose.yml << 'EOF' services: searxng: image: searxng/searxng:latest container_name: searxng ports: - "8080:8080" volumes: - ./searxng:/etc/searxng:rw environment: - SEARXNG_BASE_URL=http://localhost:8080/ restart: unless-stopped EOF # Create settings.yml with JSON API enabled cat > searxng/settings.yml << 'EOF' use_default_settings: true server: secret_key: "change-me-to-random-string" bind_address: "0.0.0.0" port: 8080 search: safe_search: 0 autocomplete: "google" default_lang: "en" formats: - html - json EOF ``` ### Technical Analysis The documented Docker configuration publishes container port 8080 through the host binding `"8080:8080"`. Docker normally interprets this as a binding on all available host interfaces. The application is also explicitly configured with `bind_address: "0.0.0.0"`, making the SearXNG interface reachable from any network allowed by the host firewall. The instructions do not configure authentication, HTTPS, a reverse proxy, or network-level access restrictions. If applied on an Internet-facing server or an untrusted local network, the search interface and JSON API can therefore be accessed by unauthorized users. The configuration additionally uses the known placeholder `secret_key: "change-me-to-random-string"`. Any SearXNG functionality that depends on the secrecy or unpredictability of this value would not receive the expected security protection. The instructions also use the mutable `searxng/searxng:latest` image tag, so subsequent deployments can execute a different upstream image without a corresponding review of the skill. ### Attack Path 1. A user copies the documented Docker and Sea ...[truncated 1618 chars]- Remediation
View remediation